bugtraq - Reverse shell using netcat on AS/400

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <002501c5363f$123fd560$2301000a@PTVN028514>
Date: Fri, 1 Apr 2005 00:14:43 +0200
From: "Shalom Carmel" <shalom@...era.com>
To: "bugtraq" <bugtraq@...urityfocus.com>
Subject: Reverse shell using netcat on AS/400

Reverse shell using netcat on AS/400

Overview
------------
Netcat, dubbed the TCP/IP "Swiss Army knife", is a simple Unix utility
which reads and writes data across network connections,
using TCP or UDP protocol. An indispensable tool, netcat stars in network
hacking manuals as one of the most versatile and powerful utilities.

A netcat executable file compiled on AIX can be successfully deployed
on some AS/400 servers.

Details
----------
The AS/400 operating system has an optional feature called
Portable Application Solutions Environment, or in short PASE.

PASE provides an integrated run-time environment for AIX applications
running on AS/400. For many applications, this means that all you have
to do is place the AIX executables in an AS/400 folder, chmod it to
executable
permissions, and run it via the AS/400 PASE shell.
In particular, the netcat utility can be successfully executed, both as
client and as server, including the -e option for reverse shell execution.
No special AS/400 privileges are required for the installation and execution
of netcat, except for the ability to place a file via FTP,
and the ability to CALL a program.

An AS/400 user with some very basic Unix knowledge
can now download netcat to the AS400
by the built-in FTP client, and start using it right away.

Vulnerable systems:
-----------------------
AS/400 servers with PASE installed.
How do you know if your server has PASE? The easiest is to issue this
command:

CALL PGM(QP2TERM)

This program is the PASE shell.
If you get a screen with a command line and with "/QOpenSys/usr/bin/-sh "
on the top, then you have PASE installed.
Alternatively, look for licensed program 5722SS1 option 33.

Workaround:
----------------
Secure the access to PASE: limit permissions to programs QP2TERM,
QP2SHELL, and QP2SHELL2. If you have audit turned on, audit their usage.
In your firewall, add rules restricting unnecessary outgoing connections
from your AS/400 server to the Internet.

References
-------------
http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/rzalf/rzalfintro.htm

For full details and examples of reverse shells please read the PDF file
found at
http://www.venera.com/downloads.htm

Shalom Carmel